fix: reject non-decimal numeric config values

[vycdev2]

Summary

• require decimal-digit syntax for non-negative integer environment settings
• fall back to documented defaults for exponent, hexadecimal, and signed values
• add regression coverage and document the fix

Verification

• npm test — passed: 330 tests
• git diff --check — passed

Risk

• Low: valid decimal values, surrounding whitespace, bounds, and defaults keep their existing behavior.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.